Health and social services information: private health bodies and technology suppliers
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Commission d’accès à l’information
- Obligation class
- Consent, Security, Breach notice, Governance, Prohibition
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- If you operate a private health facility, a specialized medical centre, a laboratory, a private seniors’ residence or another body listed in Schedule II, or provide health or social services for a health and social services body under an agreement, treat the health and social services information you hold as confidential and use or communicate it only as the Act allows or with the express consent of the person concerned.
- Treat information as held by you even where you entrust its keeping to a third person.
- Do not acquire or use a non-certified technological product or service in the cases or circumstances a regulation under section 92 provides for.
- If you supply a certified technological product or service to a body under a contract, ensure that the body complies with the criteria a regulation under section 92 prescribes throughout the term of the contract.
- If you have cause to believe that a confidentiality incident involving information you hold has occurred or may occur, take reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature.
- If the incident presents a risk of serious injury, promptly notify the Minister and the Commission d’accès à l’information and notify each person whose information is concerned.
- Keep a register of confidentiality incidents and send a copy to the Minister or the Commission on request.
- Do not sell or otherwise alienate information held by a body.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Anyone who sells or otherwise alienates information held by a body, or who contravenes section 93 or 94, commits an offence under section 160 and is liable to a fine of $5,000 to $100,000 in the case of a natural person and $15,000 to $150,000 in all other cases.
Penalty structure
The figure is the ceiling for a person other than a natural person under section 160.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 150,000
What it makes you log
Who may demand the log
Regulator
Logging duty
The register's content is left to a government regulation and is not itself specified in the Act.
- Kind
- Explicit
- As of
- Provision
- CQLR c R-22.1, s. 110
- Trigger
- security_incident
What this law does
A person or group operating a private health facility, a specialized medical centre, a laboratory or a private seniors’ residence, among others named in Schedule II, is a health and social services body under the Act. A person or group that enters into an agreement with a health and social services body to provide health services or social services on behalf of that body is itself a health and social services body.
All information held by a body is confidential and, subject to the express consent of the person concerned, must not be used or communicated except in accordance with the Act. Information is considered held by a body even where the body entrusts its keeping to a third person. No body may, in the cases or circumstances a regulation under section 92 provides for, acquire or use a non-certified technological product or service.
A technological product or service supplier that supplies a certified technological product or service to a body under a contract must ensure that the body complies with the criteria a regulation under section 92 prescribes throughout the term of the contract.
A body that has cause to believe that a confidentiality incident involving information it holds has occurred, or that there is a risk of one occurring, must take reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature. If the incident presents a risk of serious injury, the body must promptly notify the Minister and the Commission d’accès à l’information, and must also notify any person whose information is concerned by the incident.
A body must keep a register of confidentiality incidents. Anyone who sells or otherwise alienates information held by a body, or who contravenes section 93 or 94, commits an offence and is liable to a fine of $5,000 to $100,000 in the case of a natural person and $15,000 to $150,000 in all other cases.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .